@m8t-stack/cli 0.2.152 → 0.2.154

package/dist/cli.js

@@ -1464,7 +1464,7 @@ function installFoundryDnsShim() {
 }
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.152";
+var CLI_VERSION = "0.2.154";
 
 // src/lib/render-error.ts
 init_errors();
@@ -16106,17 +16106,35 @@ function hydrateAgentContent(content, destRoot, persona) {
     fs11.rmSync(stage, { recursive: true, force: true });
   }
 }
-function swapInto(from, dest) {
-  if (!fs11.existsSync(from)) {
-    fs11.rmSync(dest, { recursive: true, force: true });
+function moveAside(source, backup, ops) {
+  try {
+    ops.renameSync(source, backup);
+  } catch (e) {
+    const err = e;
+    if (err.code !== "EXDEV") throw e;
+    ops.cpSync(source, backup, { recursive: true });
+    ops.rmSync(source, { recursive: true, force: true });
+  }
+}
+function swapInto(from, dest, ops = fs11) {
+  if (!ops.existsSync(from)) {
+    ops.rmSync(dest, { recursive: true, force: true });
     return;
   }
-  fs11.mkdirSync(path11.dirname(dest), { recursive: true });
+  ops.mkdirSync(path11.dirname(dest), { recursive: true });
   const old = `${dest}.old-${process.pid.toString()}`;
-  fs11.rmSync(old, { recursive: true, force: true });
-  if (fs11.existsSync(dest)) fs11.renameSync(dest, old);
-  fs11.renameSync(from, dest);
-  fs11.rmSync(old, { recursive: true, force: true });
+  ops.rmSync(old, { recursive: true, force: true });
+  const hadDest = ops.existsSync(dest);
+  if (hadDest) moveAside(dest, old, ops);
+  try {
+    ops.renameSync(from, dest);
+  } catch (e) {
+    if (hadDest && !ops.existsSync(dest) && ops.existsSync(old)) {
+      ops.renameSync(old, dest);
+    }
+    throw e;
+  }
+  ops.rmSync(old, { recursive: true, force: true });
 }
 async function resolveToken(deps) {
   const env = deps.env ?? process.env;
@@ -17951,6 +17969,42 @@ function personaFoundryTools(persona, frontmatter2) {
   });
   return rawTools;
 }
+function equalJson(a, b) {
+  if (Object.is(a, b)) return true;
+  if (typeof a !== typeof b || a === null || b === null) return false;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((entry, i) => equalJson(entry, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ar = a;
+    const br = b;
+    const keys = Object.keys(ar);
+    return keys.length === Object.keys(br).length && keys.every((key2) => Object.prototype.hasOwnProperty.call(br, key2) && equalJson(ar[key2], br[key2]));
+  }
+  return false;
+}
+function normalizeFoundryEchoes(value) {
+  if (Array.isArray(value)) return value.map(normalizeFoundryEchoes);
+  if (!value || typeof value !== "object") return value;
+  const source = value;
+  const normalized = Object.fromEntries(
+    Object.entries(source).map(([key2, entry]) => [key2, normalizeFoundryEchoes(entry)])
+  );
+  if (source.type === "function" && source.strict === null) delete normalized.strict;
+  if (source.type === "mcp") {
+    const allowed = source.allowed_tools;
+    if (allowed && typeof allowed === "object" && !Array.isArray(allowed)) {
+      const names = allowed.tool_names;
+      if (Array.isArray(names) && Object.keys(allowed).length === 1) {
+        normalized.allowed_tools = names.map(normalizeFoundryEchoes);
+      }
+    }
+  }
+  return normalized;
+}
+function equivalentToolDefinition(a, b) {
+  return equalJson(normalizeFoundryEchoes(a), normalizeFoundryEchoes(b));
+}
 
 // src/lib/deploy-prompt-advisor.ts
 init_esm();
@@ -19546,11 +19600,11 @@ function fromBuild(raw, fallbackRef) {
   };
 }
 var DEV_TAG = "v0.0.0-dev";
-var PINNED_INSTALLER = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-installer:v0.1.116","registry":"ghcr.io/m8t-labs","image":"m8t-installer","tag":"v0.1.116"}', "ghcr.io/m8t-labs/m8t-installer");
+var PINNED_INSTALLER = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-installer:v0.1.124","registry":"ghcr.io/m8t-labs","image":"m8t-installer","tag":"v0.1.124"}', "ghcr.io/m8t-labs/m8t-installer");
 var PINNED_CODING_AGENT = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-coding-agent:v0.1.5","registry":"ghcr.io/m8t-labs","image":"m8t-coding-agent","tag":"v0.1.5"}', "ghcr.io/m8t-labs/m8t-coding-agent");
 var PINNED_AZURE_EXECUTOR = fromBuild('{"ref":"ghcr.io/m8t-labs/m8t-azure-executor:v0.1.5","registry":"ghcr.io/m8t-labs","image":"m8t-azure-executor","tag":"v0.1.5"}', "ghcr.io/m8t-labs/m8t-azure-executor");
 var PINNED_PLATFORM_VERSION = (() => {
-  const raw = "0.8.7";
+  const raw = "0.8.9";
   return /^\d+\.\d+\.\d+$/.test(raw) ? raw : "";
 })();
 
@@ -21865,6 +21919,16 @@ function adoptedAcrTopologyError(live, adoption) {
   }
   return null;
 }
+async function assertLiveAdoptedGatewayTopology(args) {
+  const live = await readLiveGatewayDeployment(args.gatewayResourceId);
+  const topologyError = adoptedAcrTopologyError(live, args.adoption);
+  if (topologyError) {
+    throw new LocalCliError({
+      code: "PLATFORM_GATEWAY_ADOPTION_DRIFT",
+      message: `Adopted gateway held before infra converge: ${topologyError}.`
+    });
+  }
+}
 async function readAcrDigest(subscriptionId, acrName, image) {
   try {
     const value = (await runAz(["acr", "repository", "show", "--subscription", subscriptionId, "-n", acrName, "--image", image, "--query", "digest", "-o", "tsv"])).trim();
@@ -22551,22 +22615,41 @@ async function applyAgentImage(a, ctx, opts) {
   const digest = a.component === "codingAgent" ? ctx.manifest.components.codingAgent.digest : ctx.manifest.components.azureExecutor.digest;
   return { tag: a.to, digest };
 }
-function declaredFillableFields(personaPath) {
+function readPersonaFrontmatter(personaPath) {
   let raw;
   try {
     raw = fs26.readFileSync(personaPath, "utf8");
   } catch {
-    return [];
+    return null;
   }
   const fmMatch = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
-  if (!fmMatch) return [];
+  if (!fmMatch) return null;
   try {
-    const fm = parseYaml11(fmMatch[1]);
-    return fm["fillable-fields"] ?? [];
+    return parseYaml11(fmMatch[1]) ?? {};
   } catch {
-    return [];
+    return null;
   }
 }
+function isRuntimePersonaTool(tool) {
+  if (tool.type !== "mcp") return false;
+  const label = tool.server_label;
+  return label === "brain" || label === "a2a";
+}
+function convergePersonaTools(currentTools, declaredTools) {
+  const personaTools = (declaredTools ?? []).map((tool) => tool).filter((tool) => !isRuntimePersonaTool(tool));
+  const runtimeTools = (currentTools ?? []).filter(isRuntimePersonaTool);
+  return [...personaTools, ...runtimeTools];
+}
+function personaPostCreateMismatches(candidate2, actual, expectedVersion) {
+  const mismatches = [];
+  if (actual.version !== expectedVersion) mismatches.push("version");
+  const { tools: expectedTools, ...expectedDefinition } = candidate2.definition;
+  const { tools: actualTools, ...actualDefinition } = actual.definition;
+  if (!equivalentToolDefinition(actualDefinition, expectedDefinition)) mismatches.push("definition");
+  if (!equivalentToolDefinition(actualTools ?? [], expectedTools ?? [])) mismatches.push("tools");
+  if (!equivalentToolDefinition(actual.metadata ?? {}, candidate2.metadata)) mismatches.push("metadata");
+  return mismatches;
+}
 function defaultsOf(declared) {
   const out = {};
   for (const f of declared) {
@@ -22600,7 +22683,12 @@ async function applyPersona(a, ctx, opts) {
   const personaPath = path27.join(opts.personaDir, "persona.md");
   const yamlValues = readAgentYaml(opts.agentName)?.fillableFieldValues ?? null;
   const values = resolveFillableValues(current, yamlValues);
-  const declared = declaredFillableFields(personaPath);
+  const frontmatter2 = readPersonaFrontmatter(personaPath);
+  const declared = frontmatter2?.["fillable-fields"] ?? [];
+  const tools = convergePersonaTools(
+    current.definition.tools,
+    personaFoundryTools(a.personaName ?? opts.agentName, frontmatter2 ?? {})
+  );
   if (declared.length > 0 && values === null) {
     const defaultBody = injectAndRender(personaPath, defaultsOf(declared), opts.agentName);
     const candidateInstructions = composeInstructions({
@@ -22639,7 +22727,9 @@ async function applyPersona(a, ctx, opts) {
     productVisibility: productVisibilityFor(opts.agentName),
     ...values ? { fillableFieldValues: JSON.stringify(values) } : {}
   };
-  const candidate2 = { definition: { ...current.definition, instructions }, metadata };
+  if (frontmatter2?.version === void 0) delete metadata.personaVersion;
+  else metadata.personaVersion = String(frontmatter2.version);
+  const candidate2 = { definition: { ...current.definition, instructions, tools }, metadata };
   if (isNoop(candidate2, current)) return "noop";
   const foundryVersion = await createAgentVersion({
     credential: ctx.credential,
@@ -22648,6 +22738,19 @@ async function applyPersona(a, ctx, opts) {
     definition: candidate2.definition,
     metadata
   });
+  const applied = await getAgentVersion({
+    credential: ctx.credential,
+    projectEndpoint: opts.project.endpoint,
+    agentName: opts.agentName
+  });
+  const mismatches = personaPostCreateMismatches(candidate2, applied, foundryVersion);
+  if (mismatches.length > 0) {
+    throw new LocalCliError({
+      code: "PLATFORM_PERSONA_VERIFY_FAILED",
+      message: `Foundry did not persist the converged persona '${a.personaName ?? opts.agentName}' exactly (mismatch: ${mismatches.join(", ")}); refusing to stamp tree ${a.to}.`,
+      hint: "Re-run the converge after Foundry reports the created version as latest; persistent mismatch requires platform investigation."
+    });
+  }
   return { treeSha: a.to, foundryVersion };
 }
 
@@ -23259,7 +23362,7 @@ function bindRepoApi(token, repo) {
 }
 async function runSeedRefresh(args) {
   const targetCommit = args.manifest.platform.commit;
-  const theirsRoot = await resolveReleaseContentWithAgents(args.manifest, {});
+  const theirsRoot = await resolveReleaseContentWithAgents(args.manifest, { contentDir: args.contentDir });
   const repos = dedupeBrainRepos(args.agents);
   const results = [];
   let delivered = 0;
@@ -23456,6 +23559,19 @@ async function buildConvergeDeps(args) {
     async applyInfra(a, ctx) {
       const target = infraTargetSha(ctx.manifest, args.tree);
       if (a.reason !== "forced") return applyInfraDeploy(a, ctx, target);
+      const stampOutcome = await readStampOutcome({
+        credential: args.credential,
+        subscriptionId: args.subscriptionId,
+        resourceGroup: args.resourceGroup
+      }).catch(() => ({ source: "unreadable" }));
+      if (stampOutcome.source === "unreadable") {
+        throw new LocalCliError({
+          code: "PLATFORM_GATEWAY_ADOPTION_STAMP_UNREADABLE",
+          message: "Forced infra held before deployment because the platform stamp could not be read, so gateway adoption authority is unknown.",
+          hint: "Restore access to the platform stamp, then let the next converge retry."
+        });
+      }
+      const adoption = stampOutcome.source === "explicit" ? stampOutcome.stamp.components.gateway.adoption : void 0;
       const infraTable = await openInfraParamsTable({ credential: args.credential, subscriptionId: args.subscriptionId, resourceGroup: args.resourceGroup });
       const stamped = (await readInfraParams(infraTable))?.bicep;
       if (!stamped) {
@@ -23501,6 +23617,12 @@ async function buildConvergeDeps(args) {
         ...stamped.location ? { location: stamped.location } : {},
         ...voiceInternalSecret ? { voiceInternalSecret } : {}
       };
+      if (adoption) {
+        await assertLiveAdoptedGatewayTopology({
+          gatewayResourceId: args.gatewayResourceId,
+          adoption
+        });
+      }
       return applyInfraDeploy(a, ctx, target, opts);
     },
     async healthGate(_ctx, applied) {
@@ -23587,6 +23709,7 @@ async function buildConvergeDeps(args) {
       const { delivered, noop: noop2, failed } = await runSeedRefresh({
         credential: args.credential,
         kvUri,
+        contentDir: ctx.contentDir,
         manifest: ctx.manifest,
         agents: discoveredAgents,
         version: ctx.manifest.platform.version,